APN connector trust policy
This page is for your security team. It explains what the APN connector role allows, who can use it, and why.
The connector at a glance
| Resource | Name | What it does |
|---|---|---|
| IAM role | FlowStateAPNConnectorSandbox or FlowStateAPNConnectorProduction | FlowState uses it to read and write your co-sell opportunities. |
| IAM role | FlowStateAPNEventForwardSandbox or FlowStateAPNEventForwardProduction | EventBridge uses it to send Partner Central events to FlowState. It can only put events on the FlowState event bus. |
| EventBridge rule | FlowStateAPNEventsSandbox or FlowStateAPNEventsProduction | Sends Partner Central opportunity events for your catalog to FlowState. |
| Systems Manager parameter | /flowstate/apn-connector/lock/<Sandbox or AWS> | The catalog lock. |
All of these are in the us-east-1 Region (IAM roles are global). The published CloudFormation template and OpenTofu module create them.
The trust policy
The trust policy on the connector role says who may use the role. It allows exactly two things together:
- Only FlowState’s own service roles may use your role. The wizard lists them as the FlowState principal ARNs.
- Only with your ExternalId. Every request must carry the secret ExternalId of your tenant.
The CloudFormation stack and the OpenTofu module in the wizard fill in both, so you never write this policy yourself.
The FlowState principals
FlowState uses several of its own service roles to work with Partner Central: to check the connection, send deal changes, receive AWS changes and run the MCP tools. The trust policy must list every one of them. The wizard always shows the current list.
The list can grow when FlowState adds a service. If your role trusts fewer principals than the wizard shows, see Updating the connector.
The ExternalId
The ExternalId is a secret that FlowState generates for your tenant and shows in the wizard. It must match exactly, with no spaces before or after it. Otherwise AWS denies the request.
It protects you against the confused-deputy problem . Another FlowState tenant does not know your ExternalId, so it cannot make FlowState use your role.
The permissions
| Policy | Type | What it allows |
|---|---|---|
AWSPartnerCentralSandboxFullAccess (Sandbox) or AWSPartnerCentralOpportunityManagement (Production) | AWS managed | The Partner Central actions for opportunities. AWS maintains these policies, so your security team can review them in the AWS documentation. |
ReadCatalogLock | Inline | ssm:GetParameter on the catalog lock parameter only. |
FlowState can do only what these policies allow. It does not store AWS keys. It gets short-lived credentials each time it uses the role.